mcpField
M
MCP Compliance

MCP Compliance

Local
github.com/grafanaLegal & Government4Updated 86w ago
Repository

About MCP Compliance

MCP Compliance provides CLI tools and an MCP server for users and agents working with FedRAMP compliance data. It supports control discovery and evidence guidance using FedRAMP Rev 5 HIGH and MODERATE baselines.

Key features

  1. 01Process and query FedRAMP baseline data
  2. 02Retrieve controls and control families
  3. 03Search controls by keyword
  4. 04Get control evidence guidance

Use cases

  1. 01Understand security control requirements
  2. 02Find controls in a specific family
  3. 03Consult evidence guidance for a control

MCP support

The MCP server exposes tools for retrieving controls and families, searching controls, and getting evidence guidance to LLM agents.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

No install method listed yet

We haven’t collected a package or remote endpoint for this server. Follow the instructions in the project README.

Repository

Tools

No tool list yet

Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.

Details

From the project README

MCP Compliance

A project for compliance that provides CLI tools and an MCP server for agents to interact with compliance data.

Overview

The FedRAMP Compliance MCP Server is designed to support users throughout their compliance journey, which consists of three main phases:

  1. Understanding - Learning about security controls, their requirements, and how they apply to your system
  2. Implementing - Designing and implementing controls in your system to meet compliance requirements
  3. Evidencing - Collecting and documenting evidence to demonstrate compliance with controls

This project provides tools for working with FedRAMP compliance data, including:

  1. CLI tools for processing and querying FedRAMP baseline data
  2. An MCP server that exposes compliance data to LLM agents

Roadmap

This project is missing the automation of evidence collection. There needs to be a way to securely store what may be sensitive data in a shared location that provides the proper ACLs and data protection. This is intended to be added in a future hackathon or additional roadmap time.

Easy Button Quick Start

For the quickest setup:

# Create the directory for the MCP compliance binary
mkdir -p ~/.mcp-compliance/bin

# Add to your PATH (add this to your .bashrc or .zshrc for persistence)
export PATH=$PATH:~/.mcp-compliance/bin

# Clone the repository
git clone https://github.com/grafana/hackathon-12-mcp-compliance.git
cd hackathon-12-mcp-compliance

# Build and deploy locally
make deploy-local

Now you can configure your agent (Cursor or Claude Desktop) to use the MCP compliance server. See the Getting Started Guide for configuration details.

Documentation

MCP Server

The MCP server provides the following tools for LLM agents:

  • get_control: Get detailed information about a specific control
  • get_control_family: Get all controls in a specific family
  • list_control_families: List all control families in a program
  • search_controls: Search for controls by keyword
  • get_control_evidence_guidance: Get detailed guidance for evidence about a specific control

Data Sources

The FedRAMP baseline files are sourced from the official GSA FedRAMP Automation GitHub repository:

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.